Tapp 0.17.6

The gate tells the truth — policy v3. ⚠️ Behavior change for web gates.

• Web targets default to --fail-on medium: any deterministic finding at medium severity or above (broken links, missing anchors, unresolvable outbound hosts, undeliverable mailto domains, missing assets) fails the gate. On a website, a 404 in the nav IS the release blocker. --fail-on gate restores the previous baseline-diff behavior; --fail-on high|medium are available on every platform.
• A green PASS states what it ignored: "PASS — N deterministic finding(s) below the fail threshold" instead of silence over known findings.
• tapp ci inside an initialized repository connects to it (platform + target identity from the application model); a web gate with no target exits 2 with guidance instead of a stack trace; ci --help speaks in tapp ci terms.
• The outbound link audit runs in the live browser (client-rendered "content isn't available" shells are visible; egress-proxy honored), findings are attributed to the page that carried the link, and a truncating probe cap reports probe-cap-reached honestly.
• tree/open list <details>/<summary> toggles, type links as Link, carry bounding rects, and mark truncated lists; the per-action trace renders in report.html.

The core engine remains MIT licensed and runs in infrastructure you control.